video-download — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited video-download (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Wraps yt-dlp with automatic recovery for YouTube anti-bot challenges.
scripts/download.py — installs yt-dlp on first run, merges video+audio to MP4, auto-rotates strategies on bot detection, uses a download-archive for safe resume.
playlist?list= URL → add --playlist.# Single video, current directory
python scripts/download.py "https://www.youtube.com/watch?v=..."
# Multiple URLs to a folder
python scripts/download.py "URL1" "URL2" -o "/path/to/output"
# Full playlist as 720p MP4
python scripts/download.py "https://www.youtube.com/playlist?list=..." --playlist -o "./out"
# Force a specific browser for cookies (skips auto-rotation)
python scripts/download.py "URL" --cookies-from-browser chrome
# Force a manual cookies.txt file
python scripts/download.py "URL" --cookies "~/Downloads/www.youtube.com_cookies.txt"
# Higher quality
python scripts/download.py "URL" --max-height 1080| Flag | Default | Notes |
|---|---|---|
-o, --output | cwd | Output directory |
--max-height | 720 | Max video height (e.g. 1080, 480) |
--playlist | off | Download full playlist; default is single-video |
--cookies-from-browser | auto | Force one browser; skips auto-rotation |
--cookies | auto | Force one cookies.txt file; skips auto-rotation |
--no-archive | off | Disable .download-archive.txt resume tracking |
When a request fails with bot-detection markers (Sign in to confirm, LOGIN_REQUIRED), the script automatically advances through these strategies in order, stopping at the first one that succeeds:
default,tv,mweb,web_safari. Bypasses softer blocks.chrome → edge → firefox → brave → vivaldi → opera,only browsers actually installed on the system.
~/Downloads/www.youtube.com_cookies.txt, youtube*cookies*.txt, cookies.txt (< 7 days old to be considered fresh).
If all 4 strategies fail, the script prints a context-aware recovery walkthrough (see "Recovery instructions for the user" below).
If the user explicitly passes --cookies-from-browser or --cookies, the chain is skipped and only that source is used (useful when the user already knows what works).
When all strategies fail, the script auto-prints a step-by-step guide. Surface the most relevant subset to the user verbatim — it is concrete and actionable.
The guide branches based on what the script saw:
re-export cookies right now, since YouTube invalidates cookies aggressively once a bot-block triggers.
<https://chromewebstore.google.com/detail/get-cookiestxt-locally/cclelndahbckbenkjhflpdbgdldlbecc>
<https://addons.mozilla.org/en-US/firefox/addon/cookies-txt/>
account.
"Current Site" option so only youtube.com cookies are included.
(auto-detected, newest wins):
www.youtube.com_cookies.txt (extension default — easiest)youtube.com_cookies.txtcookies.txtautomatically.
App-Bound Encryption locks the cookie database while the browser runs. Costs the user their open tabs unless "Continue where you left off" is enabled.
Fastest if the user already has a VPN.
Recommend only if no other option fits.
--download-archive .download-archive.txt is enabled by default. Already-downloaded videos are skipped on re-runs, so it's safe to re-run after partial failure or when adding more URLs to the same folder. Pass --no-archive to disable.
{title} [{id}].mp4{NNN} - {title} [{id}].mp4 (zero-padded index keeps order in file managers)--windows-filenames is always on, so files are safe across OSes.
--cookies-from-browser chrome requires Chrome closed on Windows(App-Bound Encryption locks the cookie DB while Chrome is running).
"Get cookies.txt LOCALLY" Chrome extension and drop the file in ~/Downloads/. The script picks it up automatically on next run.
YouTube (single + playlists), Instagram, TikTok, Twitter/X, Facebook, Vimeo, Reddit, and 1000+ more via yt-dlp.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.